A���v����`nB��=O�9�����M�H��$QՌ4T����˧B��s��t�i��敕.����j���*x��Qjx)K��i��l+h�~�q+D��n(4���<Y���oɺY����$��J��@�� ���Z�q�3 ������p�8Kc,�'�)*'&#��~Q�.bB,;�f �O�ာɛBv�(x�DX���{ ���� ��7�ߛ��ʋy�mJ��m�>�%|;\�����٥��Y~˟�_��S��VD�tnZ�8�xxqtUUq$��q:~���������/����b��Q����P��"V�c��pRi�%�%K2m�ʽ���ip�)L6 �3�*���We�r��J��tw�v��it4N1ç�n�m�_�;������Gl2���.Ѭ�9,�>갷���$: A��*ż!P�1��3�������L���=(�ÍF�N\��xC}� A��&��ՏҞ}R' i�=ܰR��<C,J(�N'���^��tS�y�9D�3�Y��ת�0��#��.�����*v m ��4��r������*�R�4]˾�w�94%��G���J\6�Y�3! *���,���+9r��%b�ܛ;*�.��ӉFkʹ�7�L��B��~L�W(���Đ����h8�[f 3��:훹1Gt��C�7�)m;BR�! Bj���[��HQ<�'3/@�N��7eC�W�e�Noua� %��*No�Fp�yA6Ì�VљS�_�a7�o~̀�r@Cپ1jT���II��$0Ȃ�4�SQ_�j�뇶E�j�)�toe%�4mb'm�=���T�h�z�TѢ¤�iW`���ع� 3��^��,��U5[=��9�#�5t�9����иkD���lgi.`p"�ゾ ��z[��nG$O_2L=���m��u~{re]�/H|J��3�QD� ��Uź�}�1���1F���\;^%F3�ws!UأX�z||S�d�������7�$�i-4�0���:8���L/�Q� Z���ٝc�c��ik���V��cM����)sZ�I�Gf���t�z^�"�ZDI�~6���$�:����ha���rh9r�&�����R�y� ��O같��S6Ԃu��� D�{r�F_��0Zؗ�.�p d! -`��q�d?�'�ýqTd�C�2tA�>���o��zD�T3�)��n��=n80���=���Yd?�Բ����Yt��YzՑ#j}� ��/�q3���RjA���;�؞Z���{ҏ�y�@X ���<��n-��{�MQH��ʆ��1������(������Dץ�&��S��#m!�JD��h]��SE|��L��z��~W����>�,)��o�&p�o��4� � � ]6�����WS�*3��1�o�gY����Z-J�yPA������x ��&��R�H;��:��N�n�I��o�Ԝ���Y�����:�j?��D8k���-q9��0p�h�ݒy�J�[-�:������$Aq�P]��#�C� S�,���3��Bv�Hb�~o����s�P��L+�^23�՛��@�e���"j��(�>�T8l����(͚�E.+`|#����Al���=%��K��,ekg�\F�<Ol�2a���ڣ��Y�y�8�IEHcQ ���l�g|��s�8J![���z���A$D�=���ϩ$yQ��)�}�g Ev�x�L��ϼJ�Bы8��� Z!k ߕ��W����K�M�φ�Z��4�0��uiZ�����*��!��=����w��9ϝKh��N���.q${8!/i �s����.;Zht���c!�������G0��Jj�I;~���ٞ>�9�U���M'nG�p���P` 芷�#�\A��x��Q�]X e�o�x���;� G�i�-[ǀĿf�y1y����]R����Z�%&dVa+(�8�k/0Gu�ϥ���x�ױs���v)6��"D�Feb���l�B�H���fI�C��ˣ����V��A��QL�,�ԣ�'D�-��xUxt:�������/դ촅I&s ��B����%��Ҧc=�Lʏ����-���ͧa����D�$���7=�%�GFmHL�����j��f}:,�a�h/7�ÞN�}��4�/'�h��ǖ{��+8'�!bk���#�9�}�z)c �Y�r���:�T�ǾE-ꜭ'�C���ʸ%��U�r�sr�o-H �ov'� Ϫ��O����Q��iS84W!y���;)IU�&��@�?~-�V��k��Q���x�I�l>bG�%|w|�8x01K"l��=$��d��\��^��8��_ ��vC��Ny��w���ߘ`�l|sk8��m9��˪��f�'<^�����؏\�R�ݨ�g�g�����jB�����zkC����������s`͜�1���+�aj�Ԡ���,p�\=�8��a%x#)�Ph'\�Ёh�*:�k�T@�_�-��\PT�����X;l�ED����c������]Z2�S=����#ܬ�1rF�B�v������I�F��g"��g/������$i %� ��7����ey��z�KԺ���V��.# y3HN�Z�"q�"U��o]۶Q.�aH{��F�P����ו���������~�ߤ�#���e���� 1�wٽO��aa�ϵG�A��xs�ֺz�i00���hP�x�^�B-�?Tƞǔ\�"S������F:Ve�̿����tGw䆓N�2+��4b�,xA�<�nJ�S��3�������\I4�,��zK����b�KV��|@���F��ˆ��:��=��Z���w�5����PwTD��4�O+��<t<ywe��:>��&��ez����=�e0Γ6��Jd�ԩ\v��k�B/s�/YNQF�uُ������g@q��&�3�5[B��gm"�D�1V�h`����π��>�Ͽ�������r�����Z����~)�x��l���ꏾo(:��b�{P�p�ލdm|7�K�p!<g n]gN3�������5�� �����Я���̣S��/�N��Eg{ ��"T��U����2�G��d(�����e�h��
Behavioral task
behavioral1
Sample
fa16a63bf3bc617259fedae12a9c4b7563ddaaa4a168c16b021966cf79afb81f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
fa16a63bf3bc617259fedae12a9c4b7563ddaaa4a168c16b021966cf79afb81f.exe
Resource
win10v2004-20231023-en
General
-
Target
fa16a63bf3bc617259fedae12a9c4b7563ddaaa4a168c16b021966cf79afb81f
-
Size
12.3MB
-
MD5
bad1d0d8fea908908f4d901b2701b7cb
-
SHA1
c14ae331bddee1d4e8a686246c150bf9e57b4b81
-
SHA256
fa16a63bf3bc617259fedae12a9c4b7563ddaaa4a168c16b021966cf79afb81f
-
SHA512
b69cc03be755ac202235d1c1183985c2254f3f74f44e3044c8c071498358e4a2b3362bb6dd5d496991dbd267ffbd1c1966af8f8daec8241a57e7ed715f0bee70
-
SSDEEP
196608:OrNuiuR85Vlz2QN6yVIEXeZm6yfXBbH4iwR9zQa6vg7rkJT081I0isHfe2C5b:1ikYlSkrXimXXBHbwReY7IJIUIZCfNE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa16a63bf3bc617259fedae12a9c4b7563ddaaa4a168c16b021966cf79afb81f
Files
-
fa16a63bf3bc617259fedae12a9c4b7563ddaaa4a168c16b021966cf79afb81f.exe windows:5 windows x86
a55de67d104e599f4ac28ce80071b2c9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowRgn
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
CLSIDFromString
CoGetSystemSecurityPermissions
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
shlwapi
UrlIsW
Exports
Exports
Sections
.text Size: - Virtual size: 958KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 802KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.1MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 204KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE